# From Audit Log to AI Governance Platform. How Chron Is Closing the Gap > Source: > Published: 2026-08-26 07:54:48+00:00 When teams started adopting AI coding tools — Claude, Cursor, Codex, GitHub Copilot, they got productivity. What they didn't get was visibility. No one could answer: *What did the AI actually do? What prompts were sent? What code was changed? Were any secrets exposed?* For developers, this didn't matter much. For a CISO or a compliance officer trying to prepare a SOC 2 audit or respond to an incident? It was a blindspot the size of a barn door. That's the gap Chron was built to close. [Chron](https://www.npmjs.com/package/chron-mcp) is an MCP server that sits alongside your AI tool and creates a **tamper-evident, locally-stored audit trail** of every session. Every message, every tool call, every code change — logged to a SQLite database on your machine. No cloud. No vendor. Your data stays with you. ``` npm install -g chron-mcp ``` Once installed, it plugs into Claude, Cursor, Windsurf, Codex, or any MCP-compatible tool and starts recording immediately. Chron started as a session logger. It's now becoming something more: a full **AI actions recorder**. What that means in practice: The result: a chain of custody for every AI interaction in your organisation. The honest reality is: most developers don't think about audit trails. They shouldn't have to. But when something goes wrong — a leaked credential, an unexpected code change, a compliance question from a regulator — the CISO needs answers fast. Chron's `report` command generates evidence packages mapped to frameworks: ``` # SOC 2 evidence package chron report --format=soc2 # Activity summary chron report --since=30d ``` The SOC 2 report maps Chron's controls to CC6, CC7, and CC8 — the access, change management, and risk mitigation criteria auditors look for. ISO 27001, ISO 42001, EU AI Act, and NIST AI RMF mappings are also included. SIEM integrations mean the logs can flow to Splunk, CrowdStrike LogScale, or Azure Sentinel, so the security team sees AI activity alongside everything else. We're not done. The direction is clear: move from individual developer tool to **organisational AI auditor platform**. What's coming: The goal: the moment a regulator or external auditor asks "show me what your AI tools did last quarter," you hit one command and hand them a signed, timestamped, tamper-evident package. Chron has crossed **8,000 downloads** — organic, without a launch campaign. The teams installing it are doing so because they recognise the gap. Big compliance platforms are now moving in the same direction. We shipped months ahead of them. And the local-first, data-sovereignty-first architecture is something a SaaS compliance cloud simply can't match for regulated industries. If you're running AI tools in your organisation and don't yet have an audit trail — Chron is the fastest way to get one. ``` npm install -g chron-mcp ``` Try it. If it helps you — or if something's missing for your workflow — [let us know](https://github.com/nivaya/chron-mcp). Real feedback gets rewarded.